Private manufacturing company

Profile narrative

The organisation is a private manufacturing company headquartered in Poland. It was among the targets of a coordinated cyberattack that occurred on 29 December 2025. The attack affected multiple sectors including energy and industrial facilities across the country. Initial intrusion was achieved through internet‑exposed FortiGate VPN devices that lacked multi‑factor authentication. After gaining entry, the attackers moved laterally within the victim’s Windows domain to obtain administrative privileges. At the manufacturing site they deployed a PowerShell‑based wiper to overwrite files.

The file‑overwriting routine of the wiper was reportedly generated by a language model, indicating a novel use of AI‑assisted malware. The attackers also attempted to use Group Policy Objects to spread the wiper, a technique observed at other compromised sites. CERT Polska attributed the entire campaign to a single Russia‑linked threat group, characterising the activity as purely destructive. No information about the company’s specific products, market scope, size, or ownership structure is provided in the available sources. Consequently, the profile is limited to the confirmed details of the organisation’s location, sector, and the incident in which it was involved.

Incidents

1 incident linked to this organisation.